--- title: "Coassemble Embed Partner Security, Data Protection & AI FAQ" description: "This article answers common security, data protection, compliance, authentication, and AI-related questions for Coassemble Embed partners." canonical_url: "https://support.coassemble.com/articles/coassemble-embed-partner-security-data-protection-ai-faq-LGfxA2MLdl" md_url: "https://support.coassemble.com/articles/coassemble-embed-partner-security-data-protection-ai-faq-LGfxA2MLdl.md" --- # Coassemble Embed Partner Security, Data Protection & AI FAQ This article answers common security, data protection, compliance, authentication, and AI-related questions for **Coassemble Embed partners**. ## Data storage, regions, and encryption ### Where is data stored and processed? By default, all customer data is stored and processed on **US-based infrastructure** (currently **Oregon, USA**). This includes: * Course content * Uploaded documents * AI processing ### Can you guarantee data is processed in a specific region? Yes, on the **Controlled Release server** *(previously referred to as Enterprise)* with **region locking** enabled. * The **Standard Release server** *(previously referred to as Production)* does not currently offer this guarantee. * **Region-Locked Server** options are available for **EU**, **US** and **APAC**. For more detail on server options, see **Server architecture** below. ### What encryption standards are used? * **Data at rest:** Encrypted using **AES-256** * **Data in transit:** Encrypted using **TLS 1.2** * **Database encryption:** Encrypted at rest, with encryption keys managed by our hosting provider ## Environment segregation ### Are different environments segregated? Yes. We use separate environments and separate databases for **production** and **testing**. ## Server architecture ### What server options are available? Your server environment is chosen upfront as part of partnership setup. Configuration **cannot be changed after sign-up** without starting a new account. Available options: * **Standard Release server** *(previously Production)*: Shared environment that receives platform updates immediately on each release. * **Controlled Release server** *(previously Enterprise)*: Shared environment that receives platform updates **two weeks after** the Standard Release server, giving customers extra preparation time. * **Region-Locked Server**: Data is processed and stored within a specified region (**EU**, **US** or **APAC**) for partners with data residency or compliance requirements. * **Dedicated server**: Private, single-tenant environment. Can optionally be region-locked. * **Self-hosting**: Available for partners with specific deployment requirements. Subject to commercial approval. ## Authentication and cookies (Embed) ### Does the Embed experience use cookies? No. The **Embed** experience *(previously referred to as Headless)* is designed to work reliably inside iframes and is **cookie-less by design**. This explicitly avoids issues caused by **third-party cookie blocking** in embedded contexts (for example, in Safari/Chrome when an iframe is treated as a third party). ### Is each iframe load stateless? The embed flow does not rely on a cookie-based session on Coassemble's domain. Authentication is handled using a short-lived token (JWT) rather than cookies. ### How does authentication work for Embed? 1. When the embeddable mounts, it **holds a JWT in memory**. 2. The embeddable uses that JWT for **each request** made to Coassemble's server. 3. The JWT has a **3-hour expiry**. 4. A **refresh mechanism** is used to maintain continuity when the token expires. ### Does Coassemble use cookies anywhere? Yes. Coassemble **does use cookies for regular (non-embed) login** experiences outside the embed flow. ### What should partners communicate to customers? If you're embedding Coassemble in an iframe and need to minimise reliance on browser cookies, use the **Embed** approach. For security/privacy documentation, it's helpful to note that the embed flow does not depend on third-party cookies, while the standard login flow may set cookies. ## Access controls and logging ### What internal access controls are in place? We follow an internal **Access Control Policy**, which can be provided upon request. Only authorised engineers have administrative access to production systems. ### Are audit logs maintained? Yes. API calls and data access are logged across our systems. ## Compliance, legal, and documentation ### What certifications do you hold? We hold a **SOC 2 Type 2** certification. Documentation is available via the Coassemble Trust Centre: * ### What certifications does your hosting provider hold? Our hosting infrastructure (via **Render**) sits on providers that maintain **SOC 2 Type 2** and **ISO 27001** certifications. ### Are you GDPR compliant? Yes, we comply with **GDPR** requirements. ### Do you have a Data Processing Agreement (DPA)? Yes. Our standard **DPA** is available and includes provisions covering data processing for **AI-driven features**. ### Can you provide audit reports or security assessments? Yes, on request. ## Data retention, deletion, and opt-outs ### How long is customer-uploaded data retained? Indefinitely by default, unless deletion is requested. ### How can partners delete data? Using the Embed API, you can delete courses via the available endpoint. Any UI to initiate deletion would need to be built into your integration. ### How do you handle opt-out requests? Opt-out processes are typically implemented on the partner side. We provide an API endpoint for course deletion to support these workflows. ## Backups, incident response, and monitoring ### What backup procedures are in place? We support **point-in-time recovery**, allowing us to restore data to any point within the last **7 days**. ### What is your incident response plan? We maintain an **Incident Response Plan** and a **Business Continuity and Disaster Recovery Plan** to respond to data-related incidents. These can be provided upon request. ### How do you detect security and availability issues? We use: * **Vanta** for continuous monitoring of data security and privacy controls * **BetterStack** for real-time system and model availability monitoring * **Segment** to detect unusual or unexpected usage patterns ## Privacy and PII ### Is personally identifiable information (PII) required by your system? The Embed API integration does not require partners to pass any PII to identify users. We recommend Embed partners only share **anonymous identifiers** with Coassemble. ### What types of data are collected when documents are uploaded? Uploaded documents are converted into a format suitable for processing by the LLM. Only document content (not PII) is sent to the LLM for processing. When using features such as **Transform a document**, the uploaded file is securely stored in object storage. ### Where is your privacy policy? * ## AI processing ### Which AI providers and models do you use? Coassemble integrates directly with **Google's AI services**: * **Gemini Flash** for text generation (course generation, document transformation, text refinement, translation) * **Gemini 2.5 Flash Image** for AI-generated images * **Chirp** for AI narration voices ### How is customer data used in AI training? Customer content, prompts, and uploaded documents are **never** used to train the underlying models. ### Who owns AI-generated course content? The customer retains **full ownership** of all content created in Coassemble, whether AI-generated or manually authored. ### Are there token or file size limits for uploads? There are no strict token limits. Our primary guidance is pedagogical, and we recommend keeping courses under **25 screens**. Large documents (100+ pages) can be uploaded, but the resulting content will be heavily summarised. The models we use support a **1 million-token** context window. ### How long is model context retained? Context required for course generation is stored long-term in our database. ### What guardrails exist against AI hallucinations? Our system includes guardrails designed to keep generated content aligned with training and learning objectives. All LLMs remain susceptible to hallucinations, so full factual accuracy cannot be guaranteed. AI generation is intended to get creators **80–90%** of the way to a complete course, with a human review pass recommended to finalise. ### What's the failover strategy if an AI provider has issues? We monitor model availability via BetterStack and use operational controls to maintain reliability. In some configurations, Coassemble may use routing infrastructure (such as **OpenRouter**) to improve availability and manage failover across providers/models. See for more detail. ### What happens if you change AI providers? All customers are notified in advance. Partners on the **Controlled Release server** *(previously referred to as Enterprise)* receive an additional **2 to 4 weeks** notice. ## Subprocessors and infrastructure ### Where are your subprocessors located? Our subprocessor list is available via the Coassemble Trust Centre: * ### Do you vet your subprocessors? Yes. We review vendor documentation and rely on published certifications and security assurances. ### Who hosts the underlying infrastructure? We use **Render** as our hosting provider. Render handles physical security, and the underlying infrastructure providers maintain **SOC 2 Type 2** and **ISO 27001** certifications. ### How are denial-of-service attacks handled? We rely on Render's built-in protections, and our infrastructure auto-scales to absorb high-load or DOS-style traffic. ## Security testing ### Do you conduct penetration testing? Yes. We conduct an annual penetration test covering the platform broadly. ## Third-party providers ### What happens if a third-party AI provider experiences a breach? We notify customers following our incident response plan and adjust provider usage as needed.